Approval, vault, logs, policies
Plain TypeScript in Electron. It shows you the decision. It does not keep the secret.
The layer that holds secrets does not talk to agents. The layer that talks to agents does not hold secrets.
Plain TypeScript in Electron. It shows you the decision. It does not keep the secret.
AES-256-GCM under a passphrase-wrapped key (scrypt or Argon2id), the policy floor, single-use grants. Keys are decrypted here for one call — never persisted, never logged.
IDEs speak MCP. The warden scores metadata. Neither side receives the key.
sequenceDiagram
participant Agent
participant Policy
participant Warden
participant You
participant Vault
Agent->>Policy: request_capability
alt Write under a read ceiling
Policy-->>Agent: denied, model never called
else Inside the ceiling
Policy->>Warden: agent, alias, scope, reason
Warden-->>You: risk, and a scope it cannot widen
You->>Vault: approve once
Vault-->>Agent: the tool result, key absent
end
A self-approve hits 401. MCP has no approve tool. The daemon token stays in the app and the CLI.
MCP, HTTP, audit rows, the UI, and the model prompt. A canary covers 27 surfaces and fails the build on a hit.
Decrypted at call time for one grant. The app never writes it to disk and never logs it.
The warden can shrink a scope. It cannot step past the alias ceiling.
After the call, after the TTL, or the moment you revoke.
The daemon does not listen on the network. Human routes want the daemon token.
Fooled, malformed, or missing: policy and you decide. The floor does not move.
The shipped catalogue is what Settings exposes. A larger model is better at spotting a write phrased as a read. It is not a wider permission.
Encrypted at rest. A human approves. The secret is not a field you can copy back out.
Who asked, which scope, what they claimed, and what the warden thinks. That context is the product.
The same daemon boundary, on hardened hardware.
The same human decision, outside the desktop app.
Ceilings you share. The floor still cannot be widened by a model.
The canary test and the verification notes are in the repo.
The architecture shows where the model sits. The research shows what it catches, what it costs, and where it fails.